CVE-2024-52301

🗓️ 12 Nov 2024 19:32:14Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 470 Views🌐 WEB

Laravel framework register_argc_argv vulnerability fixed in multiple version

Reporter	Title	Published	Views	Family All 26
GithubExploit	Exploit for Argument Injection in Laravel Framework	15 Nov 202419:11	–	githubexploit
BDU FSTEC	The vulnerability of the `register_argc_argv` configuration in the PHP framework Laravel allows attackers to compromise the integrity of the protected information.	21 Nov 202400:00	–	bdu_fstec
Circl	CVE-2024-52301	12 Nov 202422:15	–	circl
CNNVD	Laravel 参数注入漏洞	12 Nov 202400:00	–	cnnvd
Cvelist	CVE-2024-52301 Laravel allows environment manipulation via query string	12 Nov 202419:32	–	cvelist
Debian	[SECURITY] [DLA 3997-1] php-laravel-framework security update	21 Dec 202414:59	–	debian
Debian CVE	CVE-2024-52301	12 Nov 202419:32	–	debiancve
Tenable Nessus	Debian dla-3997 : php-illuminate-auth - security update	21 Dec 202400:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2024-52301	6 Mar 202500:00	–	nessus
Tenable Nessus	Symfony < 5.4.46 / 6.x < 6.4.14 / 7.x < 7.1.7 Improper Input Handling	7 Nov 202400:00	–	nessus

NVD

Vulners

Vulnrichment

Node

laravel frameworkRange<6.20.45

laravel frameworkRange7.0.0–7.30.7

laravel frameworkRange8.0.0–8.83.28

laravel frameworkRange9.0.0–9.52.17

laravel frameworkRange10.0.0–10.48.23

laravel frameworkRange11.0.0–11.31.0

Node

debian debian_linuxMatch11.0

[
  {
    "vendor": "laravel",
    "product": "framework",
    "versions": [
      {
        "version": "< 6.20.45",
        "status": "affected"
      },
      {
        "version": ">= 7.0.0, < 7.30.7",
        "status": "affected"
      },
      {
        "version": ">= 8.0.0, < 8.83.28",
        "status": "affected"
      },
      {
        "version": ">= 9.0.0, < 9.52.17",
        "status": "affected"
      },
      {
        "version": ">= 10.0.0, < 10.48.23",
        "status": "affected"
      },
      {
        "version": ">= 11.0.0, < 11.31.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h
lists	www.lists.debian.org/debian-lts-announce/2024/12/msg00019.html

Parameter	Position	Path	Description	CWE
--env	query param	exploit.php	CVE-2024-52301: When register_argc_argv is enabled, a crafted query string (e.g., --env) can influence environment handling in Laravel, enabling attacker-controlled environment changes via a GET parameter.	CWE-88